Privacy Policy

Effective: 2026-09-28. Last updated: 2026-10-12.

This policy describes how MediaFrame (operated by Smart Signals LLC, "we") collects, uses and protects information when you use the Service, including through the API and connected AI agents. Smart Signals LLC is the controller of this information.

1. Information we collect

Account data: your email address and, if you sign in with Google, the basic profile Google shares (name, email); if you sign in with Apple, the email address Apple shares, which may be a private relay address that Apple forwards to you. Stored in Amazon Cognito, with your plan and an account identifier.
Billing data: handled by Stripe — we never see or store your card number. We keep the Stripe customer and subscription identifiers and the plan they correspond to.
Questions you ask (Ask): your question is sent to Amazon Bedrock to generate the answer. We do not store the text of your questions; we keep a count of how many you asked each day, for up to 2 days, to enforce your plan's limit. According to AWS, Amazon Bedrock does not store prompts and answers or use them to train models.
API keys (Premium) and connected AI agents (any plan): for each API key, a one-way hash (never the key itself), the name you chose and its creation date; for each AI agent you connect, the app's name and address and when you connected it (kept until you disconnect it), and hashed refresh credentials, which expire at most 30 days after you connected.
Watchlist and alerts (any plan): the themes and region you choose to watch; your alert settings (how often, which signals, quiet hours and your time zone); and, for each device where you turn alerts on, the push address and encryption keys your browser gives us and a device name such as "iPhone · Safari". An alert carries only the kind of signal, its theme and a link to the board, never your email address or any article text.
The MediaFrame app (iOS and Android): the app shows the same board and collects nothing the website does not. When you turn alerts on in the app, we keep the push token Apple or Google gives the app, with the same settings as above. The app identifies itself to us as the app (in its browser user agent), so it can leave out purchase links; it contains no advertising SDK and does not track you across other apps or websites.
Usage data: request logs (time, endpoint or dataset, plan, account identifier); outbound clicks — when you open a source link through the board, we record the link, its theme and your account identifier, for 90 days, to measure which sources are useful; and CDN access logs (IP address, user agent, requested path), kept 7 days raw and up to 90 days in processed form for aggregate analytics.
Messages you send us: email to our addresses (for example contact@mediaframe.me) is forwarded by Cloudflare to our mailbox hosted by Google, and kept as long as needed to handle your request and keep a record of it.
Reports you send from Ask: when you report a defect or a suggestion about an answer, we keep your text, the question and answer it is about with their cited sources, the board view, your plan and your account identifier. Only the MediaFrame team reads them, only to fix and improve the Service; they are never published, and any ticket we write from one leaves out your account, question, answer and sources. Kept 90 days.
Cookies and local storage: see §7.

2. How we use it, and on what basis

To authenticate you, provide your plan and enforce its limits, and bill you (performance of our contract with you); to operate, secure and improve the Service and produce aggregate, non-personal usage analytics (our legitimate interests); and to keep billing records (legal obligation). We do not sell your personal data, and we do not use it for advertising or to train models.

3. Retention

Account data: while your account is active. When you delete your account (§6), your account, alert devices, alert settings, watchlist, API keys, connected agents and the reports you sent from Ask are deleted straight away; if you ask us by email instead, within 30 days. Request logs, which identify an account only by its identifier, are not rewritten: they expire on the schedule below.
Request logs: 90 days. Outbound clicks: 90 days. CDN logs: 7 days raw, 90 days processed.
Ask counters: 2 days. Reports sent from Ask: 90 days, with no backup kept beyond that.
API keys: until you revoke them or close your account. Connected-app records: until you disconnect the app; their refresh credentials expire at most 30 days after you connected.
Watchlist, alert settings and alert devices: until you change or remove them or close your account; a device is removed automatically once its browser stops accepting alerts. The list of signals already sent to you, so that none is sent twice: the most recent 300.
Billing records: kept by Stripe as financial regulations require.

4. Service providers and transfers

Amazon Web Services (hosting, storage, authentication, AI models — United States, us-east-1), Stripe (payments, tax calculation), Google (optional sign-in; our email mailbox) and Cloudflare (DNS; forwarding email sent to our addresses). Apple is also an optional sign-in. When you turn alerts on, your browser's push service (Apple, Google, Mozilla or Microsoft, depending on the browser) — or, in the app, Apple Push Notification service or Firebase Cloud Messaging — receives each alert, encrypted, to deliver it to your device. Each processes data under its own terms. When you connect an AI assistant (for example Claude or ChatGPT), it receives the results your agent requests, on your instructions and under its provider's terms; we send it nothing else. Your data is processed in the United States. We do not share personal data with anyone else, except where the law requires it.

5. Security

All traffic is encrypted (HTTPS). API keys and refresh credentials are stored only as one-way hashes; access tokens for connected agents are signed by a key held in AWS KMS and expire after one hour. Internal systems use least-privilege access, and we conduct periodic security reviews.

6. Your rights

You may request access to, correction, export or deletion of your personal data by emailing contact@mediaframe.me; we respond within 30 days. You can revoke API keys, disconnect agents, turn alerts off or remove alert devices, and delete your whole account yourself, on the web or in the app, at mediaframe.me/auth/account (deletion asks you to sign in once more first), and cancel billing in the billing portal. If you are in the European Economic Area or the United Kingdom (GDPR) or in Brazil (LGPD), you also have the right to object to processing based on legitimate interests and to complain to your data-protection authority (in Brazil, the ANPD).

7. Cookies and local storage

Cookies (all functional): griffon_s (your signed-in session), griffon_r (renews the session without signing in again; sent only to the renewal endpoint), griffon_st (sign-in state, 10 minutes), griffon_ra (proves you just signed in again before deleting your account, 5 minutes) and __Host-oauth_csrf (protects the connect-an-agent consent step, 10 minutes).

Browser local storage (never sent to us): your theme, the last tab you viewed, your dashboard layout and pins, and whether you dismissed the analysis notice. This device's copy of your watchlist and region is also kept here; the watchlist itself is kept with your account (§1). When you add MediaFrame to your home screen, the browser also keeps a copy of the board pages you opened, so they open without a connection; signing out deletes it.

We use no tracking or advertising cookies.

8. Contact

contact@mediaframe.me

MediaFrame · Smart Signals LLC · Terms · Privacy · Pricing · contact@mediaframe.me